bug-triage — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bug-triage (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Triage open bug issues on apify/apify-mcp-server. Analyze, draft responses, get approval, post.
gh issue list), viewing details and comments (gh issue view) — do these automatically, no need to ask.gh issue comment), closing (gh issue close), editing (gh issue edit) — always present the draft and wait for explicit user approval before executing.$ARGUMENTS controls scope:
| Input | Behavior |
|---|---|
623 641 639 | Triage specific issue numbers |
--label bug | Triage all open issues with label (default: bug) |
--all | Triage all open bug-labeled issues |
| _(empty)_ | Same as --all |
Use the arguments parsed in Step 0 to determine what to fetch.
If specific issue numbers were provided, skip the list queries and fetch each issue directly:
gh issue view <number> --repo apify/apify-mcp-server --commentsOtherwise (label mode, --all, or empty), fetch open bug reports. Use the label from Step 0 (default: bug). Bug reports come in two forms — find both:
[Bug] in the title (the bug report template adds this, but the label isn't always applied)# By label (use the label from Step 0, default: bug)
gh issue list --repo apify/apify-mcp-server --label <label> --state open --json number,title,labels,createdAt,body --limit 30
# By title prefix (catches unlabeled bug reports)
gh issue list --repo apify/apify-mcp-server --state open --search "[Bug] in:title" --json number,title,labels,createdAt,body --limit 30Merge both lists and deduplicate by issue number.
For each issue, fetch full details including all comments (comments often contain the real context):
gh issue view <number> --repo apify/apify-mcp-server --commentsAlways read comments before drafting a response. Previous team members may have already replied, asked for details, or provided workarounds. Don't duplicate existing responses.
Assign one of these categories:
| Category | Criteria | Typical action |
|---|---|---|
| Known fix | Root cause is clear, documented fix exists | Draft response with fix, optionally close |
| Not our bug | Server logs show it works; issue is in the MCP client (Claude Desktop, Cowork, etc.) | Explain findings, suggest workaround |
| Duplicate | Same root cause as another open issue | Comment with link, close as duplicate |
| Needs info | No logs, no config, vague description | Ask for specifics |
| Stale | We asked for info, no reply for 2+ weeks | Close with helpful pointer |
| Actionable bug | Real server-side bug we need to fix | Acknowledge, investigate further |
These patterns recur. Check for them first:
/sse URLs get connection failures. Fix: switch to https://mcp.apify.com (streamable HTTP).tools/list, but Claude doesn't use the tools in conversation. This is a Claude Desktop/Cowork behavior, not an Apify server bug. Users need to explicitly ask Claude to use Apify tools.https://mcp.apify.com as a custom connector.rm -rf ~/.npm/_npx (macOS/Linux) or rmdir /s /q %LOCALAPPDATA%\npm-cache\_npx (Windows).Style rules:
Key documentation links:
https://docs.apify.com/platform/integrations/mcphttps://docs.apify.com/platform/integrations/claude-desktop#troubleshootinghttps://mcp.apify.comUse Apify MCP tools (search-apify-docs, fetch-apify-docs) to find the right doc link if the issue touches a topic not covered above.
The default recommendation for connection issues is the remote server:
Add a custom connector in Claude Desktop with URL https://mcp.apify.com and follow the OAuth flow.Present each issue to the user with:
https://github.com/apify/apify-mcp-server/issues/<number>)MANDATORY: Wait for explicit user approval before posting anything. Never post, close, or modify an issue without the user saying yes.
After approval:
# Comment only
gh issue comment <number> --repo apify/apify-mcp-server --body "<response>"
# Comment + close
gh issue comment <number> --repo apify/apify-mcp-server --body "<response>" && \
gh issue close <number> --repo apify/apify-mcp-server
# Close as duplicate
gh issue comment <number> --repo apify/apify-mcp-server --body "Closing as a duplicate of #<other> — same root cause. We'll track and update there." && \
gh issue close <number> --repo apify/apify-mcp-serverThen move to the next issue. After the last one, print a summary table:
| Issue | Category | Action taken |
|---|---|---|
| #623 | Known fix | Commented, SSE migration |
| #639 | Duplicate | Closed as dup of #641 |
| ... | ... | ... |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.